The sunset period of SHA-1 is approaching [1] and FIPS 140 certificates have a validity of 5 years. Any distros starting FIPS certification for their kernels now would therefore most likely end up on the NIST Cryptographic Module Validation Program "historical" list before their certification expires. While SHA-1 is technically still allowed until Dec. 31, 2030, it is heavily discouraged by NIST and it makes sense to set .fips_allowed to 0 now for any crypto algorithms that reference it in order to avoid any costly surprises down the line. [1]: https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm Acked-by: Stephan Mueller <smueller@xxxxxxxxxx> Cc: Marcus Meissner <meissner@xxxxxxx> Cc: Jarod Wilson <jarod@xxxxxxxxxx> Cc: Neil Horman <nhorman@xxxxxxxxxxxxx> Cc: John Haxby <john.haxby@xxxxxxxxxx> Signed-off-by: Vegard Nossum <vegard.nossum@xxxxxxxxxx> --- crypto/testmgr.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/crypto/testmgr.c b/crypto/testmgr.c index 82977ea25db39..797613daf7e33 100644 --- a/crypto/testmgr.c +++ b/crypto/testmgr.c @@ -4285,7 +4285,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { .alg = "authenc(hmac(sha1),cbc(aes))", .test = alg_test_aead, - .fips_allowed = 1, .suite = { .aead = __VECS(hmac_sha1_aes_cbc_tv_temp) } @@ -4304,7 +4303,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { .alg = "authenc(hmac(sha1),ctr(aes))", .test = alg_test_null, - .fips_allowed = 1, }, { .alg = "authenc(hmac(sha1),ecb(cipher_null))", .test = alg_test_aead, @@ -4314,7 +4312,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { .alg = "authenc(hmac(sha1),rfc3686(ctr(aes)))", .test = alg_test_null, - .fips_allowed = 1, }, { .alg = "authenc(hmac(sha224),cbc(des))", .test = alg_test_aead, @@ -5156,7 +5153,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { .alg = "hmac(sha1)", .test = alg_test_hash, - .fips_allowed = 1, .suite = { .hash = __VECS(hmac_sha1_tv_template) } @@ -5498,7 +5494,6 @@ static const struct alg_test_desc alg_test_descs[] = { }, { .alg = "sha1", .test = alg_test_hash, - .fips_allowed = 1, .suite = { .hash = __VECS(sha1_tv_template) } -- 2.34.1
